Data protection in research

Normally, research projects need the approval of the Regional Committees for Medical and Health Research Ethics (REC) and the Norwegian Centre for Research Data (NSD).

Contents

• Are the data anonymised?
• Cases of doubt
• Approval body for your research project
• Read more about data protection
• Routine

Are the data anonymised?

The first question it is important to ask is whether you are going to use anonymised data or not. Anonymised data are information that cannot be used to identify individuals in the data material, neither directly through names, personal ID numbers or other unique characteristics or indirectly via background variables, nor through a list of names / connection key or encryption formula or code. You must be aware of the fact that the information in itself may be enough to identify the individual participant. The personal data will in such case not be deemed to be adequately anonymised.

You must also note that a compilation of various databases can de-anonymise personal data in such a way that the research participants can be identified.

If the data is totally anonymised, you do not have to apply to an external body.

Nettskjema (uio.no) can be used if you like the survey to be anonymious. Check website for action to ensure anonymity (in Norwegian only) and website about electronic track (in Norwegian only).

You can read about how you can conduct projects without registering personal data on NSD's website.

Informasjon and brochure on NSD`s website (in Norwegian only).

Cases of doubt

There can be cases of doubt in which it is uncertain whether research data has been adequately anonymised or not, e.g. in the case of small samples, in, for example, research on a diagnosis that few people in Norway have or a research project with few research participants within a limited geographical area. In cases of doubt you should check with the data protection official (NSD). NSD also has an informal obligation to notify test that you can try.

Approval body for your research project

The objective determines where you must apply for approval 

If you are going to use data that have not been adequately anonymised in your research project, you must consider what external bodies you must apply for approval from. The objective of the research and the type of data to be used in the research project is decisive for your choice.

Objective 1 - You must apply for approval from NSD when:

Research with an objective other than to generate new knowledge about illness and health can be covered by both the Personal Data Act and the Personal Health Data Filing System Act.

• Social science objectives.
• Quality assurance, defined as projects, surveys, evaluations etc. whose objective is to ensure that diagnostics and treatment actually produce the intended results.
• The establishment of health registers, defined as registers, lists etc. in which health data is stored systematically (listed) so that information about individuals can be retrieved, cf. Section 2 (6) of the Personal Health Data Filing System Act. Health registers can be paper-based or electronic. For example, registers such as records systems in the health service can be used or created for research purposes, see Section 2 (2) of the Health Research Act.
• The collection of health data with an objective other than to generate new knowledge about health and illness, see Section 2 (1) and 4 d) of the Health Research Act.
• See Examples of activities that do not require approval from REC on REC's website.

Collection of health informastion for the purpose of obtaining new knowledge about health and illness shall be notified to NSD after REC has made justification assessment.

More information how to notify NSD.

List of definitions of the terms in the table.

Objective 2 - You also have to get an approval from REC when:

• 'Activity conducted using scientific methods to generate new knowledge about health and illness', see Section 4 a) of the Health Research Act.
• Establishment of health registers as part of a concrete medical and health-related research project.
• Se Examples of activities that require approval from REC on REC's website.

More information how to apply to REC.

Read more about data protection

• The Norwegian National Research Ethics Committees
• Information security and personal data protection
• Guide to the Health Reserach Act (in Norwegian only)
• Code of Conduct for Information Security - the healthcare and care services sector (in Norwegian only)
• Guide for personal data protection and information security in research projects in the health and care services sector (in Norwegian only)

Routine

Procedures for notification to NSD is located on web group for research advisors at faculty/center.